Received-SPF fail: Domain of ourdomain.co.za does not designate 197.96.210.136 as permitted sender

We are trying to invite users from two domains into Payroll. One hosted with Exchange online the other with a local mail host. No invites are received when sent, nor is there any indication in the logs as to why. When sending test invites to users Gmail address and two of my locally hosted domains, Gmail goes through, as does one of my locally hosted, while the other does not. Fortunately within the Spam Quarantine Logs of one of my test domains that did not receive the invite I found the reason for the block as that provided in the subject above. 

Further scrutiny of the logs (provided below) shows this is, as far as I can tell, quite logical as Sage is sending the invite so that it appears to come [email protected] while in the background sending it from its own own server: za-relay-02.sagesouthafrica.co.za. This is essentially Spoofing which our server is correctly identifying as a possible phising attempt. For whatever reason the MS Exchange Online logs do not show any logs of the invite mail even arriving never mind being blocked for whatever reason. 

Please note we have whitelisted @sage.com and now @sagesouthafrica.co.za which has not resolved the issue - invites are still not being received. I understand we can add your servers IP: 197.96.210.136 and 10.64.4.103 to our SPF record however nowhere has this been requested of us by Sage nor can I find any mention of having to do so within your setup documentation, so am asking what your suggested fix to this problem is? For example can the invite not be sent from sagesouthafrica.co.za directly without masquerading as a [email protected]? Or does Sage have to send as a [email protected]

==============================================

Received: from za-relay-02.sagesouthafrica.co.za ([197.96.210.136]) by spe8.ucebox.co.za with esmtp (Exim 4.89) (envelope-from <[email protected]>) id 1hUdNG-0006fo-7U for [email protected]; Sat, 25 May 2019 22:34:38 +0200
Received: from SOFISHABWEB69.sageza.hosting (Not Verified[10.64.4.103]) by za-relay-02.sagesouthafrica.co.za with Trustwave SEG (v7, 3, 6, 7949) id <B5ce9a6c80000>; Sat, 25 May 2019 22:34:17 +0200
Received: from SOFISHABWEB69 ([127.0.0.1]) by SOFISHABWEB69.sageza.hosting with Microsoft SMTPSVC(10.0.14393.0); Sat, 25 May 2019 22:34:16 +0200
MIME-Version: 1.0
From: "[email protected]>
To: "TEST 2" <[email protected]>
Reply-To: [email protected]
Date: 25 May 2019 22:34:16 +0200
Subject: New user Activation for Sage Business Cloud Payroll Professional for site code U53431

Message-ID: <[email protected]>
X-OriginalArrivalTime: 25 May 2019 20:34:16.0112 (UTC) FILETIME=[389C2B00:01D51339]
Received-SPF: fail (spe8.ucebox.co.za: domain of superuserdomain.co.za does not designate 197.96.210.136 as permitted sender) client-ip=197.96.210.136; [email protected]; helo=za-relay-02.sagesouthafrica.co.za;
X-SPF-Result: spe8.ucebox.co.za: domain of superuserdomain.co.za does not designate 197.96.210.136 as permitted sender
Authentication-Results: ucebox.co.za; spf=fail [email protected]
X-Afrihost-Class: phish
X-Afrihost-Evidence: SPF

===============================================

  • 0

    Thank you for the information Johan2019, we will enquire with the development team for more detail on your post

  • 0

    The issue as mentioned in your post, seems to be blocked by the mail servers as the mail address used. We are currently reviewing what changes will be required, but unfortunately is not a quick change in the software as this will involve more testing.

    Your consultant will be contacting you shortly to provide details on the way forward.

  • 0 in reply to Francois Brand

    9 days to tell us the issue is what we suggested it was in our original post? I've reported your reply as abusive, because that is the way your response, together with that of Sage's in general over the past 3 weeks has left us, as paying customers, feeling.

    Its been three months since we started trying to use this product. We've waited in Support Ques's on hold until air time is almost gone, we are lucky if we receive a reply at all from the Technical Consultants assigned to get us up and running, one of whom has now in any event left to work from another company, selling the same and now more products. The longest most detailed email we received from her in a month of this was her informing us of her change of email address and what new products she will now be selling. Does this person or Sage really think that after the lack of support and bad service we are receiving that we or anyone would recommend their or Sages services? We need this issue fixed, by any means / work around possible in as short a time frame as possible. 

    We are paying customers and can not wait indefinitely as is being asked of us here and via email, for Sage's developers to investigate / test / implement needed changes. There has so be a work around, several of which I've suggested via email but received no reply either way. Please urgently advise as we are paying customers currently unable to use the product due to, as stated, the invites not being able to reach the intended recipients, due to what looks like an SPF issue. I've asked it via email and will ask it again here; as a temporary work around can we not just add Sage's sending servers IP to our SPF records in the hope this allows the invites to go through?

    Can the invites be sent to users private GMail addresses which seem to receive the invites? Or will these options causes issues down the line with what your developers are testing? Please, this is urgent, we have had this product now for three months and seem to be going around in circles, being passed from pillar to post with no one taking ownership of the issue.